Knowledge Management

kv_store vs dbxlookup


Hi splunkers!

Need your advice again.
We have a db table with users registrations. Millions of entries. There's an option for a user to merge with another account if for some reason he created another one. Merge happens pretty often. But there's no earliest date of registration for merged users in original table. So we address to another table where this info is stored. Make lookup of it and then make kv_store lookup of original table taking in consideration merged accounts lookup.

This kvstore lookup is used to correctly segment users' purchases, logins by their registration date.
Rewriting of this kv_store lookup takes hours and sometimes it skips..
Now we want to create outside splunk separate db table with correct registration information and to use it queries.

And here's a question: which way is better to use in this case?

  1. Dbxlookup without need to update something in splunk
  2. kv-store lookup with its complete rewriting several times a day
  3. kv-store lookup updating it values through REST API ?
Labels (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...